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Amendments to the claims (this listing replaces all prior versions): 

1 . (Currently amended) A method for real-time measurement of the performance of 
communications on a large area network between a selected server and a pluraUty of users, based 
upon actual user experience, including: 

(a) accessing a server log having records indicative of routings of actual user 
access to the selected server; 

(b) aggregating records from the server log into a plurality of aggregate slots, each 
slot having at least one time bin which represents an interval of time, based on an aggregation 
method; 

(e) performing at least one statistical analysis separately on each time bin of each 
aggregate slot; and 

(d) outputting the results of such statistical analysis as an indication of actual 
access to server usage by userst^ 

( e ) d e t e rmining e xit rout e s from e ach s e l e ct e d G e r\^ e r bas e d on th e records from 

th e s e rv^ e r log; 

(f) d e t e rmining a b e st p e rforming e xit rout e bas e d on th e statistical analysis of 

r e cords from th e s e r\^ e r log; 

(g) biasing incoming and outgoing communications with r e sp e ct to e ach ser\^er to 

us e th e d e t e rmined b e st p e rforming e xit rout e ; 

(h) d e fining a databas e comprising larg e ar e a n e twork addr e ss blocks having 
geographical or souroo information; 

(i) comparing an addr e ss fi e ld in e ach r e cord to th e addr e ss blocks in the database; 

(j) associating with e ach r e cord the g e ographical or sourc e information from an addroso 
block matching th e addr e ss fi e ld of th e record, including 

(k) d e fining an array of binary troos for th e addr e ss blocks in th e database, e ach addross 
block within a binary tr ee within an array e l e m e nt b e ing mask e d by a corresponding uniquo 
subn e t mask valu e ; 
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(1) maoking oach addr e ss fi e ld in e ach rocord by a uniqu e subnot value corr e sponding to a 
select e d array element; 

(m) comparing e ach mask e d addr e ss fi e ld to an addr e ss fi e ld of th e address blocko within 
th e binary tr ee of th e s e l e ct e d array e l e m e nt; 

(n) outputting s e l e ct e d fi e lds of any matching addr e ss block; and 

(o) oth e rwis e , continuing th e st e p of comparing with a n e xt soloctod array e l e m e nt until a 
match is found or all array e l e m e nts hav e b ee n compar e d. 

2. (Original) The method of claim 1, fiarther including fihering out selected records 
fi-om the server log before the step of aggregating. 

3. (Original) The method of claim 1, fiirther including generating an event 
notification if a selected statistical analysis value is abnormal. 

4. (Original) The method of claim 1, fiirther including selecting the aggregation 
method from a set of aggregation methods. 

5. (Original) The method of claim 1, wherein the aggregation method includes 
aggregation by log-file record column data value for each record from the server log. 

6-10. (Canceled) 

1 1 . (Currently amended) A system for real-time measurement of the performance of 
communications on a large area network between a selected server and a plurality of users, based 
upon actual user experience, including: 

(¥r^ a server log having records with data indicative of routings of actual user 
access to the selected server; 

(x) means for accessing and aggregating records from the server log into a 
plurality of aggregate slots, each having at least one time bin which represents an interval of 
time, based on an aggregation method; 

means for performing at least one statistical analysis of each time being of 
each aggregate slot; ^id 

(z) means for outputting the results of such statistical analysis as an indication of 
access to actual server usage by usersf^ 
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(aa) m e ans for dot e rmining exit routoo from e ach o e l e ctod Gon^ e r bas e d on th e 
r e cords from th e s e n'^ e r log; 

(bb) m e ans for d e t e rmining a boot performing e xit route bacod on th e statistical 

analysis of r e cords from th e s e r\^ e r log; 

(oc) m e ans for biasing incoming and outgoing communications with r e spect to 

each s e r\r e r to us e th e d e t e rmined b e st p e rforming oxit route; 

(dd) m e ans for d e t e rmining g e ographical or sourc e information for each record; and 

( ee ) m e ans for s e l e cting th e aggr e gation m e thod to aggr e gat e r e cords bas e d on such 
geographical or source information, including 

(ff) a databas e for comprising larg e ar e a n e twork address blocks having geographical or 
sourc e information; 

(gg) a comparison fimction for comparing an addr e ss fi e ld in each r e cord to th e address 
blocks in th e databas e ; and 

(hh) an associating fiinction for associating with e ach record th e g e ographical or source 
information from an addr e ss block matching th e addr e ss fi e ld of th e r e cord, including 

(ii) an array of binary trees from the address blocks in th e database, each addroso block 
within a binary tre e within an array e l e m e nt b e ing mask e d by a corresponding uniqu e subnet 
mask valu e ; 

(jj) m e ans for masking e ach addr e ss fi e ld in e ach r e cord by a unique subn e t valu e 

corr e sponding to a s e l e ct e d array e l e m e nt; 

(Idc) m e ans for outputting s e l e ct e d fi e lds of any matching addr e ss block; and 

(11) m e ans for oth e rwis e continuing th e st e p of comparing with a next sel e ct e d array 

e l e m e nt until a match is found or all array e l e m e nts hav e b ee n compar e d. 

12. (Previously presented) The system of claim 11, further including means for 
filtering out selected records from the server log before the step of aggregating, 

13. (Original) The system of claim 11, fiirther including means for generating an 
event notification if a selected statistical analysis value is abnormal. 

14. (Original) The system of claim 11, fiirther including means for selecting the 
aggregation method from a set of aggregation methods. 
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15. (Original) The system of claim 11, wherein the aggregation method includes 
aggregation by log-file record column data value for each record from the server log. 
16-20. (canceled) 

2 1 . (Currently amended) A computer program, stored on a computer-readable 
medium, for real-time measurement of the performance of communications on a large area 
network between a selected server and a plurality of users, based upon actual user experience, 
the computer program comprising instructions for causing a computer system to: 

(ss) access a server log having records of routing of actual user access to the 
selected server; 

(tt) aggregate records from the server log into a plurality of aggregate slots, each 
having at least one time bin, based on an aggregation method; 

(utt) perform at least one statistical analysis of each time bin, representing a time 
interval, of each aggregate slot; and 

(¥¥) output the results of each statistical analysis as an indication of actual server 
usage by usersf^ 

(\\w) dotormino exit routes from each soloctod Gor\^or baood on th e r e cords from the 
serv^ e r log; 

(xx) d e t e rmin e a b e st p e rforming e xit rout e bas e d on the statistical analysis of 

records from th e s e rv e r log; 

(yy) bias incoming and outgoing conununications with r e sp e ct to e ach s e r\r e r to 

us e the det e rmin e d b e st p e rforming e xit rout e ; 

(zz) d e t e rmin e g e ographical or sourc e information for e ach record; and 

(aaa) s e l e ct th e aggr e gation m e thod to aggr e gat e r e cords bas e d on such g e ographical 
sourc e information, including 

(bbb) d e fin e a databas e comprising larg e ar e a n e twork addr e ss blocks having 
g e ographical or sourc e information; 

(coo) compar e and addr e ss fi e ld in e ach r e cord to th e address blocks in the database; and 

(ddd) associat e with e ach r e cord th e g e ographical or sourc e information from an address 
block matching th e addr e ss fi e ld of the record, including 
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(e ee ) d e fin e an array of binary tr e es for tho addr e ss blocks in the databaoo, oach addross 
block within a binary tr ee within an array e l e m e nt b e ing mask e d by a corr e sponding unique 
subnet mask valu e ; 

(fff) malc e e ach addr e ss fi e ld in e ach record by a unique oubnot valu e corr e sponding to a 
sel e ct e d array e l e m e nt; 

(ggg) compar e e ach mask e d addr e ss fi e ld to an address fi e ld of the address blocks within 
th e binary tr ee of th e s e l e ct e d array e l e m e nt; 

(hhh) output s e l e ct e d fi e lds of any matching addr e ss block; and 

(iii) oth e rwis e , continu e the st e p of comparing with a n e xt select e d array element until a 
match is found or all array e l e m e nts hav e b ee n compar e d. 

22. (Original) The computer program of claim 21, fiirther including instructions for 
causing the computer system to filter out selected records fi:'om the server log before the step of 
aggregating. 

23. (Original) The computer program of claim 21, further including instructions for 
causing the computer system to generate an event notification if a selected statistical analysis 
value is abnormal. 

24. (Original) The computer program of claim 21, further including instructions for 
causing the computer system to select the aggregation method from a set of aggregation 
methods. 

25. (Original) The computer program of claim 21, wherein the aggregation method 
includes aggregation by log-file record column data for each record from the server log. 

26 - 30. (Canceled) 

31. (Previously presented) A method as in claim 1, wherein said statistical analysis 
determines time for specified user access relative to a specified interval, and sorts said user 
access according to a number of times that the application exceeds said interval. 

32. (Previously presented) A method as in claim 1, wherein said server log includes a 
time stamp indicating when a record was formed, a client IP address, a time taken to complete 
transmission, and a size of the transmission. 
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33. (Previously presented) A method as in claim 32, wherein said server log is formed 
by adding new data entry to the server log, and said server log is closed to further data entry prior 
to said performing. 

34. (Previously presented) A method as in claim 32, wherein said aggregating 
comprises determining a geographic location from the IP address, and aggregating IP addresses 
having a specified relationship with a specified geographical location. 

35. (Previously presented) A method as in claim 32, further comprising aggregating 
said time bins into chronological order and determining trends among said time bins. 

36. (Previously presented) A method as in claim 32, further comprising using said 
information to computer byte density, transfer fate, and error fraction. 

37. (Previously presented) A method as in claim 32, wherein said statistical analysis 
is an assessment of performance related measurement against a geographical location of a client. 

38. (Previously presented) A method as in claim 32, wherein said statistical analysis 
is an assessment of a route traversed during use of the network application by an end user. 

39. (Previously presented) A method as in claim 1 , further comprising determining a 
new path based on said results of said statistical analysis. 

40. (Previously presented) A system as in claim 1 1, wherein said server log includes a 
time stamp indicating when a record was formed, a client IP address, a time taken to complete 
transmission, and a size of the transmission. 

41. (Previously presented) A system as in claim 40, wherein said server log is formed 
by added new data as entries to the server log, and said server log is closed to further data entry 
prior to said performing. 

42. (Previously presented) A system as in claim 40, wherein said accessing means 
converts the IP address into a geographical location, and aggregates IP addresses having a 
specified relationship with a specified geographical location. 

43. (Previously presented) A system as in claim 40, wherein said statistical analysis is 
an assessment of performance related measurement against a geographical location of a client. 

44. (Previously presented) A system as in claim 40, wherein said statistical analysis is 
an assessment of a route traversed during use of the network application by an end user. 
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45. (Previously presented) A system as in claim 1 1 , further comprising a 
communication routing part, determining a new path based on said results of said statistical 
analysis. 

46. (Previously presented) The computer program as in claim 2 1 , wherein said 
instructions to access the server log comprises instructions to access a server log that includes 
time information about records, client IP address, time taken to compete a transmission, and a 
size of the transmission. 

47. (Previously presented) The computer program as in claim 46, wherein said 
instructions to aggregate include instructions to convert the IP address into information 
indicative of a geographical location, and to aggregate the information according to the 
geographical location. 

48. (Previously presented) The computer program as in claim 47, wherein said 
instructions to perform a statistical analysis perform a statistical analysis of performance versus 
geographical location of the client. 

49. (Previously presented) The computer program as in claim 47, wherein said 
instructions to perform a statistical analysis perform the a statistical analysis assessing a route 
traversed during a network application. 

50. (Previously presented) The computer program as in claim 21 further comprising 
additional instructions to determine a new path based on results of said statistical analysis. 

51. (New) The method of claim 34, wherein determining geographical or source 

information for each record includes: 

defining a database comprising large area network address blocks having geographical or 
source information; 

comparing an address field in each record to the address blocks in the database: and 
associating with each record the geographical or source information fi'om an address 
block matching the address field of the record. 
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52. (New) The method of claim 7. wherein comparing an address field in each record to 
the address blocks in the database includes: 

defining an array of binary trees for the address blocks in the database, each address 
block within a binary tree within an array element being masked by a corresponding unique 
subnet mask value: 

masking each address field in each record by a unique subnet value corresponding to a 
selected array element; 

comparing each masked address field to an address field of the address blocks within the 
binary tree of the selected array element; 

outputting selected fields of any matching address block; and 

otherwise, continuing the step of comparing with a next selected array element until a 
match is found or all array elements have been compared. 

53. flSFew) The method of claim 1, further including: 

determining exit routing paths fi'om each selected server based on the records fi-om the 
server log; 

determining a best performing exit route based on the statistical analysis of records fi^om 
the server log; 

biasing incoming and outgoing communications with respect to each server to use the 
determined best performing exit route. 

54. flSFew) The system of claim 1 L fiirther comprising: 

means for determining geographical or source information for each record: and 
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means for selecting the aggregation method to aggregate records based on such 
geographical or source information. 

55. (New) The system of claim 16, wherein the means for determining geographical or 
source information for each record includes: 

a database comprising large area network address blocks having geographical or source 
information; 

a comparison function for comparing an address field in each record to the address blocks 
in the database; and 

an associating function for associating with each record the geographical or source 
information from an address block matching the address field of the record. 

56. (New) The system of claim 17, wherein the comparison function includes: 

an array of binary trees from the address blocks in the database, each address block 
within a binary tree within an array element being masked by a corresponding unique subnet 
mask value; 

means for masking each address field in each record by a unique subnet value 
corresponding to a selected array element; 

means for comparing each masked address field to an address field of the address bocks 
within the binary tree of the selected array element; 

means for outputting selected fields of any matching address block ;and 

means for otherwise continuing the step of comparing with a next selected array element 
until match is found or all array elements have been compared. 

57. flSfew) The system of claim 11, fiirther including: 
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means for determining exit routing paths for each selected server based on the records 
from the server log; 

means for determining a best performing exit route based on the statistical analysis of 
records from the server log; 

means for biasing incoming and outgoing communications with respect to each server to 
use the determined best performing exit route. 

58. flS[ew) The computer program of claim 21, further including instructions for causing 
the computer system to: 

determine geographical or source information for each record; and 
select the aggregation method to aggregate records based on such geographical or source 
information. 

59. flSfew) The computer program of claim 26, vyherein the instructions for causing the 
computer systems to determine geographical or source information for each record further 
include instructions for causing the computer system to: 

define a database comprising large area network address blocks having geographical or 
source information; 

compare an address field in each record to the address blocks in the database; and 
associate with each record the geographical or source information from an address block 
matching the address field of the record. 

60. (New) The computer program of claim 27, wherein the instructions for causing the 
computer system to compare an address field in each record to the address blocks in the database 
include instructions for causing the computer system to: 



Applicant 
Serial No. 
Filed " 
Page 



Bickers taff, et al. 
09/471,964 
December 23, 1999 
12 



Attorney's Docket No. 10559-096001 



define an array of binary trees for the address blocks in the database, each address block 
within a binary tree within an array element being masked by a corresponding unique subnet 
mask value; 

make each address field in each record by a unique subnet value corresponding to a 
selected array element; 

compare each masked address field to an address field of the address blocks within the 
binary tree of the selected array element; 

output selected fields of any matching address block; and 

otherwise, continue the step of comparing with a next selected array element until a 
match is found or all array elements have been compared. 

61. (New) The computer program of claim 21, further including instructions for causing 
the computer system to: 

determine exit routing paths fi-om each selected server based on the records fi-om the 
server log; 

determine a best performing exit route based on the statistical analysis of records fi-om 
the server log; 

bias incoming and outgoing communications with respect to each server to use the 
determined best performing exit route. 



